If someone of sufficient expertise decides to hack you and take your banking info, they will, just like if someone decides to rob you on the street, they will. We assume there are vulnerabilities in any piece of software as big as Firefox. Your security depends on not being a particularly tempting individual target for highly skilled attackers and staying up-to-date enough to avoid mass automated attacks, and those factors depend on relative risks that can't even be objectively measured.
Edit/PS: I am also confident that the government would not insert back doors that are likely to be found by criminals, because those vulnerabilities would be exploited by foreign governments and would hurt U.S. commercial interests, which I imagine is the only kind of mistake that would result in Congress taking drastic punitive action (slashing budgets, reducing autonomy, increasing oversight) towards an intelligence agency.
curl -s http://www.kernel.org/pub/linux/kernel/CREDITS | grep gov
E: [email protected]
E: [email protected]
curl -s http://gcc.gnu.org/viewcvs/trunk/MAINTAINERS?view=co | grep gov
Asher Langton [email protected]
My general frustation with your blog post is that your arguments apply to many popular pieces of software. It feels disingenuous and it feels like it's provocative solely for the purpose of being provocative.You don't need TOR. You do need an ISP.
Two basic claims: Tor is tainted because (1) the concepts the software is based on were developed with partial funding from the military and (2) Zed thinks one of the committers is untrustworthy. Guess what? That describes a huge amount of software, including Mac OS X and Firefox. God damn Zed, this Hitler sandwich shit is pretty weak.
Zed also has a problem with Tor because he thinks there is a "gigantic percentage of hackers and security experts on the volunteer payroll of a group who's job is to illegally wiretap people and circumvent the law on behalf of the government". He thinks some of these people work on Tor and thus Tor is untrustworthy. Funny though, his ISP is likely guilty of the same thing. I wonder if Zed takes that into account as a part of his paranoid fantasy.
There are serious problems with using Tor and Zed fails to mention any of them. You'll want to read what Thomas has to say on the subject (http://searchyc.com/tptacek). Specifically, Thomas mentions that a general problem with tools like Tor is that it identifies your traffic as a subset of all traffic thats probably worth monitoring. You're essentially adding bright red neon signs to your most sensitive traffic. The amount of traffic going through the Tor network is small enough that it is a tractable problem for a nation state to attempt to monitor all of it. Thomas also goes into how the incentive structure for these tools is completely broken. The defenders are academic researchers going for tenure, the attackers are nation states with millions of dollars to spend, and the users are dissidents that get killed when the tool fails. Unfortunately, arguments with this level of nuance appear to escape Zed in this case. I fear he doesn't have the domain knowledge to write something intelligent about this issue.